immich/.github/workflows/draft-release.yml

name: Draft new release

on:
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

permissions: {}

jobs:
  tag:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
      rc: ${{ steps.version.outputs.rc }}
      sha: ${{ steps.version.outputs.sha }}
    permissions: {}
    steps:
      - name: Check this is a release branch
        env:
          BRANCH: ${{ github.ref_name }}
        run: |
          case "${BRANCH}" in
            release/*) ;;
            *)
              echo "::error::releases are drafted from a release branch, not ${BRANCH}"
              exit 1
              ;;
          esac

      - id: token
        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
          permission-contents: write

      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          token: ${{ steps.token.outputs.token }}
          persist-credentials: true

      - id: version
        run: |
          version="v$(jq -r '.version' package.json)"
          echo "version=${version}" | tee -a "$GITHUB_OUTPUT"
          echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
          if [[ "${version}" =~ -rc\.[0-9]+$ ]]; then
            echo "rc=true" >> "$GITHUB_OUTPUT"
          else
            echo "rc=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Checkout main
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: main
          path: main
          persist-credentials: false
          token: ${{ steps.token.outputs.token }}

      - name: Setup Mise
        uses: immich-app/devtools/actions/use-mise@06a9ef925332c91be647d6256642b86b398592c8 # use-mise-action-v3.2.1
        with:
          github_token: ${{ steps.token.outputs.token }}

      - name: Install dependencies
        run: mise //server:install

      - name: Verify the release line does not diverge from main
        env:
          MAIN_MIGRATIONS: ${{ github.workspace }}/main/server/src/schema/migrations
          ORDER: ${{ github.workspace }}/server/src/schema/migrations/ORDER
        run: mise //server:migrations verify-order --source-folder "${MAIN_MIGRATIONS}" --append-only-from "${ORDER}"

      - name: Push tag
        env:
          TAG: ${{ steps.version.outputs.version }}
        run: |
          git tag "${TAG}"
          git push origin "${TAG}"

  build_mobile:
    uses: ./.github/workflows/build-mobile.yml
    needs: tag
    permissions:
      contents: read
      pull-requests: write
    secrets:
      PUSH_O_MATIC_APP_CLIENT_ID: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
      PUSH_O_MATIC_APP_KEY: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
      KEY_JKS: ${{ secrets.KEY_JKS }}
      ALIAS: ${{ secrets.ALIAS }}
      ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
      ANDROID_STORE_PASSWORD: ${{ secrets.ANDROID_STORE_PASSWORD }}
      # iOS secrets
      APP_STORE_CONNECT_API_KEY_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}
      APP_STORE_CONNECT_API_KEY_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ISSUER_ID }}
      APP_STORE_CONNECT_API_KEY: ${{ secrets.APP_STORE_CONNECT_API_KEY }}
      IOS_CERTIFICATE_P12: ${{ secrets.IOS_CERTIFICATE_P12 }}
      IOS_CERTIFICATE_PASSWORD: ${{ secrets.IOS_CERTIFICATE_PASSWORD }}
      FASTLANE_TEAM_ID: ${{ secrets.FASTLANE_TEAM_ID }}

    with:
      ref: ${{ needs.tag.outputs.sha }}
      environment: production

  draft_release:
    runs-on: ubuntu-latest
    needs: [tag, build_mobile]
    permissions: {}
    steps:
      - name: Generate a token
        id: generate-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
          permission-contents: write
          permission-actions: read

      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          token: ${{ steps.generate-token.outputs.token }}
          persist-credentials: false

      - name: Download APK
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: release-apk-signed
          github-token: ${{ steps.generate-token.outputs.token }}

      - name: Create draft release
        env:
          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
          REPO: ${{ github.repository }}
          TAG: ${{ needs.tag.outputs.version }}
          PRERELEASE: ${{ needs.tag.outputs.rc }}
        run: |
          gh release create "${TAG}" \
            --repo "${REPO}" \
            --draft \
            --verify-tag \
            --prerelease="${PRERELEASE}" \
            --notes-file misc/release/notes.tmpl \
            --generate-notes \
            docker/docker-compose.yml \
            docker/docker-compose.rootless.yml \
            docker/example.env \
            docker/hwaccel.ml.yml \
            docker/hwaccel.transcoding.yml \
            docker/prometheus.yml \
            *.apk

  publish:
    runs-on: ubuntu-latest
    needs: [tag, draft_release]
    environment: release
    permissions: {}
    steps:
      - id: token
        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
          permission-contents: write

      - name: Publish release
        env:
          GH_TOKEN: ${{ steps.token.outputs.token }}
          REPO: ${{ github.repository }}
          TAG: ${{ needs.tag.outputs.version }}
          PRERELEASE: ${{ needs.tag.outputs.rc }}
        run: |
          previous=$(gh api "repos/${REPO}/releases/latest" --jq '.tag_name' 2>/dev/null || true)
          # version-sort the two and see which wins: if it is TAG, it supersedes the current latest
          newest=$(printf '%s\n%s\n' "${previous}" "${TAG}" | sort --version-sort | tail -1)

          if [[ "${PRERELEASE}" == "true" ]]; then
            latest=false
          elif [[ -z "${previous}" || "${newest}" == "${TAG}" ]]; then
            latest=true
          else
            # an older release line, published after a newer one
            latest=false
          fi

          echo "publishing ${TAG} (latest=${latest}, prerelease=${PRERELEASE}, previous=${previous:-none})"
          gh release edit "${TAG}" \
            --repo "${REPO}" \
            --draft=false \
            --latest="${latest}" \
            --prerelease="${PRERELEASE}"